From 3e4990738490c29d5cd196f1651db8b78c0a5397 Mon Sep 17 00:00:00 2001
From: DavidHLP <lysf15520112973@163.com>
Date: Sun, 5 Jul 2026 11:37:02 +0800
Subject: [PATCH] fix(ci): harden GitLab deploy pipeline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- only: [main] (was [main, feat/gitlab-cicd]) — test branch no longer
  triggers production deploy (BLOCKER 1)
- DEPLOY_DIR variable (default /opt/ulticode) replaces hardcoded
  /home/yw/UltiCode; refuse to deploy if .env missing under DEPLOY_DIR
  (BLOCKER 2 + MEDIUM 8)
- git fetch --prune --tags + git checkout -B replaces bare reset --hard
  so a dedicated deploy checkout is used, never a developer working tree
  (MEDIUM 12)
- docker compose up -d --wait gates deploy success on healthcheck
  passage (MEDIUM 10)

Fixes #100
---
 .gitlab-ci.yml | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 835fbb869..8b754d0e6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,16 +1,29 @@
+# GitLab CI/CD — same-server deployment via shell runner.
+#
+# Deploys to $DEPLOY_DIR (default /opt/ulticode), a dedicated checkout kept
+# separate from any developer working tree. Production deployments trigger
+# only on main; CI pipeline experimentation MUST use MR `rules` instead of
+# pushing extra branches into `only:` — never wire a test branch to prod.
+#
+# Required: .env (with all ${VAR:?...} secrets) must exist under $DEPLOY_DIR
+# before the deploy job runs. The job refuses to deploy if .env is missing.
 stages:
   - deploy
 
+variables:
+  DEPLOY_DIR: ${DEPLOY_DIR:-/opt/ulticode}
+
 deploy:
   stage: deploy
   tags:
     - shell
   script:
-    - cd /home/yw/UltiCode
-    - git fetch origin
-    - git reset --hard origin/$CI_COMMIT_BRANCH
+    - test -d "$DEPLOY_DIR" || { echo "FATAL: DEPLOY_DIR '$DEPLOY_DIR' not found"; exit 1; }
+    - cd "$DEPLOY_DIR"
+    - test -f .env || { echo "FATAL: .env missing under $DEPLOY_DIR — refusing to deploy"; exit 1; }
+    - git fetch --prune --tags origin
+    - git checkout -B "$CI_COMMIT_BRANCH" "origin/$CI_COMMIT_BRANCH"
     - docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.ci.yml build
-    - docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.ci.yml up -d
+    - docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.ci.yml up -d --wait
   only:
     - main
-    - feat/gitlab-cicd